DATA PROTECTION ADDENDUM
1Definitions

1.1

In this Addendum, unless the context dictates otherwise, the following capitalised terms
shall have the following meanings:
Client means any person or entity which has entered into a Principal Agreement with Ogier
Global Contracting Party;
Client Entity means any person to which the Services are provided or are to be provided;
Controller means the natural or legal person or entity who determines the purposes andmeans of the processing of Personal Data;
Data Breach means any 'personal data breach' as defined in the relevant Data ProtectionLaw which is confirmed as affecting or having affected any Personal Data;
Data Protection Law means the EU General Data Protection Regulation 2016/679(GDPR), the EU Privacy & Electronic Communications Directive 2002/58/EC, anyamendments and replacement legislation, European Commission decisions, binding EU
and national guidance and equivalent legislation in the jurisdictions of operation of Ogier
Global including but not limited to the UK Data Protection Act 2018; the Data Protection(Jersey) Law 2018; the Data Protection (Bailiwick of Guernsey) Law 2017, the CaymanIslands' Data Protection Law 2017 (Law 33 of 2017) and the Luxembourg Act of 1 August
2018 (Data Protection Act);
Data Subject shall have the meaning set out in the relevant Data Protection Law;
Intermediary means any person or entity which has entered on behalf of its clients into a
Principal Agreement with an Ogier Global Contracting Party;
Ogier Global Contracting Party means the member of the Ogier Global Group which hasentered into a Principal Agreement with the Client or Intermediary;
Ogier Global Group means Ogier Global Holding Company Limited and each of its
subsidiaries or affiliates and any successor to them;Ogier Global Processor means the relevant member of the Ogier Global Group which isdomiciled in the UK, the Channel Islands, the Cayman Islands or the EU which is processing
Personal Data and which may or may not be the Ogier Global Contracting Party;
Personnel means the officers, employees, agents and any Sub-Processors of that person;
Personal Data has the meaning given to it by the relevant Data Protection Law, but shall
only include personal data to the extent that such personal data, or any part of such
1

BLAW-39578264-4

personal data, is disclosed or otherwise made available to Ogier Global by or on behalf of
the Client and such data is processed by Ogier Global in relation to the services provided
under the Principal Agreement;
Principal Agreement means any agreement or contract pursuant to which the Ogier Global
Contracting Party agrees to provide certain Services to or in respect of a Client or a Client
Entity other than any agreement or contract which sets out the various data protection
obligations of the relevant parties;
Processing shall have the meaning set out in the relevant Data Protection Law andderivatives such as Process or Processed shall be construed accordingly;
Processor means an entity that processes Personal Data on behalf of and in accordancewith instructions of a Controller;
Security Measures means appropriate technical and organisational measures
implemented, documented and maintained by the Ogier Global Group to assure a level ofsecurity appropriate to the risk to the security of Personal Data as these may be revisedand updated by the Ogier Global Group from time to time;
Services means the Services which a member of the Ogier Global Group has contracted
to provide pursuant to the Principal Agreement;
Sub-Processor means an entity engaged by a Processor who agrees to receive from theProcessor Personal Data exclusively intended for the processing activities to be carried outin connection with the provision of the Services;Supervisory Authority has the meaning given to it in the relevant Data Protection Law;
and
Third Country means (i) in relation to Ogier Global Processor entities domiciled in theCayman Islands, a country or territory outside of the Cayman Islands; (ii) in relation to Ogier
Global Processor entities domiciled in the UK, the Channel Islands or the EU, a country orterritory outside of the European Economic Area.
1.2

Any reference to a statute, regulation, order, decision, or any other legal instrument in thisAddendum shall be contrived as including a reference to any subordinate legislation madethereunder and such statute, regulation order, decision or other legal instrument as thesame is amended, consolidated, re-enacted or replaced from time to time.

2

Scope of this Addendum

2.1

This Addendum shall govern any Processing undertaken by an Ogier Global Processor inconnection with the provision of Services but only to the extent that such Ogier Global
Processor undertakes the Processing in its capacity as a Processor or Sub-Processor andthe Processing falls within the scope of the Data Protection Law. For the avoidance ofdoubt, this Addendum does not apply to any Processing of Personal Data undertaken by
any member of the Ogier Global Group as a Controller.

2BLAW-39578264-4

3

Effective Date

3.1

This Addendum shall be deemed to have become effective and to have been incorporated
into the Principal Agreement:(a)if the Principal Agreement includes an express reference to this Addendum, on theeffective date of the Principal Agreement; or(b)the date on which a copy of this Addendum has been made available to the Client
where the Client continues to accept Services from the Ogier Global Group after
receiving this Addendum.

4

Roles of the Parties

4.1

For the purpose of this Addendum, the Client or the Intermediary may act as the Controller
or as a Processor. Ogier Global Group therefore acknowledges that it may act as Processor
or Sub-Processor. All obligations of Ogier Global as set out in the Addendum shall apply
to it regardless of whether it is acting as Processor or Sub-Processor.

4.2

The Client and the Intermediary each warrants and represents that it is fully compliant withthe Data Protection Law to the extent that it is applicable to the Processing of Personal
Data and any registrations made by it or on its behalf under such legislation. The Client andthe Intermediary each undertakes to perform its obligations under this Addendum and tocontinue to comply with the Data Protection Law, including if the Client or the Intermediarypasses or make available the Personal Data to a member of the Ogier Global Group or ifparties are otherwise directed to send their Personal Data to a member of the Ogier Global
Group by the Client or the Intermediary. The Client and the Intermediary shall each ensure
it has provided adequate notice to such parties as required by the Data Protection Law
relating to the Processing by the Ogier Global Processor of such Personal Data and (ifrequired) to the transfer of such Personal Data to a Third Country.

4.3

Ogier Global Processor acts as a Processor or a Sub-Processor in respect of the Personal
Data it Processes on behalf of the Client or the Intermediary on the terms set out in thisAddendum, and not as a Controller.

4.4

In connection with the provision of Services, Ogier Global Processor shall comply with its
obligations as a Processor under the applicable Data Protection Law.

5Instructions

5.1

Ogier Global Processor shall, and shall take steps to ensure that its Personnel, only
Process the Personal Data on documented instructions from the Client or Intermediary
unless otherwise required to do so by applicable law in which case Ogier Global Processor
will, unless prohibited by applicable law, inform the Client or Intermediary of that legal
requirement before Processing.

5.2

Ogier Global Processor is instructed by the Client or the Intermediary to Process Personal
Data for the purposes of performing the Services.

3

BLAW-39578264-4

5.3

Ogier Global Processor shall not be required to comply with any instruction from the Clientor the Intermediary to process the Personal Data which would cause it to breach any Data
Protection Law.

6Security

6.1

The Ogier Global Group shall implement and maintain the Security Measures to protect
against unauthorised or unlawful processing of Personal Data and against accidental lossor destructions of, or damage to, Personal Data, appropriate to the harm that might result
from the unauthorised or unlawful processing or accidental loss, destruction or damage andthe nature of the data to be protected, having regard to the state of technologicaldevelopment and the cost of implementing any measures (those measures may include,
where appropriate, pseudonymising and encrypting Personal Data, ensuring confidentiality,integrity, availability and resilience of its systems and services, ensuring that availability ofand access to Personal Data can be restored in a timely manner after an incident, andregularly assessing and evaluating the effectiveness of the technical and organisational
measures adopted by it). The Ogier Global Group may update its Security Measures fromtime to time during the term of the Principal Agreement, and shall notify the Client or theIntermediary of any material changes.

6.2

Ogier Global Processor shall ensure that all Personnel who have access to and/ or Process
the Personal Data are obliged to keep the Personal Data confidential.

7

Sub-Processing

7.1

Ogier Global Processor shall not subcontract or delegate Processing to any third party as
Sub-Processors without the consent of the Client or Intermediary (such consent from Clientor Intermediary shall not unreasonably withheld, conditioned or delayed). The consent ofthe Client or Intermediary shall be deemed to have been given in respect of any third party
to whom Ogier Global Processor is under the Principal Agreement, permitted to subcontract
or delegate part of whole of the Services.

7.2

If Ogier Global Processor engages any third party to Process any of the Personal Data,
Ogier Global Processor shall impose on such third party, by means of a written contract,terms which offer the same data protection obligations as set out in this Agreement andwhich meet the requirements of the Data Protection Law.

7.3

Where a Sub-Processor appointed by Ogier Global Processor fails to fulfil its obligations
under the Data Protection Law and this Addendum, Ogier Global Processor shall remain
fully liable to the Client or Intermediary for Processing undertaken by such Sub-Processor
under the Data Protection Law, as if the Processing was being conducted by Ogier GlobalProcessor.

8

Data Subject Requests

8.1

Ogier Global Processor agrees to notify the Client or Intermediary if it receives a Data
Subject Access Request under the Data Protection Law in respect of any Personal Data
which it is processing in its capacity as Processor and, to the extent it is permitted under
the applicable law, will refrain from directly responding to such request without first
conferring with the Client or Intermediary.
4BLAW-39578264-4

9Assistance

9.1

Ogier Global Processor agrees, having regard to the nature of the Processing and theinformation available to Ogier Global Processor, to provide reasonable assistance to theClient or Intermediary in respect of its obligations under the applicable Data Protection Law,including, without limitation, assisting the Client or the Intermediary, at their respective cost,in responding to any requests by Data Subjects exercising their applicable rights under theData Protection Law and in ensuring its compliance with its obligations under the Data
Protection Law with respect to security, breach notifications, impact assessments andconsultations with Supervisory Authorities.

10

Breach Notification

10.1

Ogier Global Processor will notify the Client or Intermediary without undue delay (and, inany event, within the timeframe prescribed by the relevant Data Protection Law) if Ogier
Global Processor becomes aware of a Data Breach.

10.2

Ogier Global Processor shall, following such notification, cooperate with the Client orIntermediary and take such reasonable commercial steps to assist in the investigation,
mitigation and remediation of such Data Breach, including providing the Client orIntermediary with such information as it reasonably requires to allow it to meet any
obligations to report or to inform Data Subjects and/or the Supervisory Authorities of theData Breach under the Data Protection Law.

11

Termination

11.1

Subject to any lien which a member of the Ogier Global Group may have the benefit ofpursuant to the terms of the Principal Agreement, on termination or expiry of the Principal
Agreement (or at any other time on written request by the Client or Intermediary), Ogier
Global Processor shall cease Processing which is not strictly required to comply with its
obligations under the Principal Agreement or this Addendum, return to the Client orIntermediary or permanently erase to the extent technically feasible and commerciallypracticable, at the election of the Client or Intermediary and at their respective expense, allcopies of Personal Data received and/or Processed by it under the Principal Agreement,
unless it is obliged to retain such Personal Data under any applicable law or regulations towhich it is subject.

11.2

Ogier Global Processor is hereby instructed by the Client and Intermediary to permanently
delete, to the extent technically feasible and commercially practicable without prejudicing
other data which it is necessary to retain for other legal obligations, all copies of Personal
Data received and/or Processed by it from the Client or Intermediary under the PrincipalAgreement, if the Principal Agreement is terminated in accordance with its terms.

11.3

Notwithstanding Clause 12.1 above, the Parties agree that Ogier Global Processor and any
Sub-Processor appointed by Ogier Global Processor shall retain Personal Data for nolonger than is necessary with regard to the purposes of the Processing, subject to any
limitation periods provided by any applicable law which Ogier Global and any SubProcessor appointed by Ogier Global Processor is subject to.

5BLAW-39578264-4

12Data Transfers

12.1

Except where Clause 13.2 applies Ogier Global Processor will not transfer Personal Data
to a Third Country without the Controller's prior written consent (such consent shall not be
unreasonably withheld, conditioned or delayed).

12.2

Ogier Global Processor may transfer Personal Data to a Third Country without theController's prior consent where:(a)the transfer of Personal Data to the relevant country is necessary to enable Ogier
Global Processor to Process the Personal Data in connection with the provision ofthe Services; or(b)the transfer otherwise complies with the relevant Data Protection Law.

13

Demonstrating Compliance

13.1

Ogier Global Processor shall, on written request setting out the nature of the information
required, make available to the Client or Intermediary all information reasonably necessary
to demonstrate compliance with its obligations set out in this Addendum and allow for andcontribute to audits, including inspections, conducted by the Client or Intermediary or
another auditor mandated by the Client or Intermediary.

13.2

The Client or Intermediary shall:(a)give Ogier Global Processor 30 Business Days' notice of any audit or inspection tobe conducted under this Clause;(b)

conduct, or ensure such audits are conducted, during normal business hours;(c)avoid (and request that each of its mandated auditors) avoids causing any damage,injury or disruption to Ogier Global's Processor or the business of any SubProcessor's appointed by Ogier Global Processor in the course of any audit orinspection;(d)ensure that appropriate confidentiality provisions are agreed with any third party
involved in any audit or inspection; and(e)such audit or inspection shall not be carried out more than once in any given twelve(12) month period.

13.3

Ogier Global Processor will immediately inform the Client or Intermediary if, in its opinion,
an instruction given or request made pursuant to this Clause 14 infringes the Data
Protection Law.

14Costs

14.1

Ogier Global Processor may require the Client or Intermediary to reimburse its costs andexpenses in complying with its obligations pursuant to Clause 9 (Data Subject Requests),
Clause 10 (Assistance), Clause 11 (Breach Notification) and Clause 14 (DemonstratingCompliance), save that where an audit or inspection conducted by or on behalf of the Client
6BLAW-39578264-4

or Intermediary under Clause 14 reveals any material non-compliance with this Addendum
by Ogier Global Processor, Ogier Global Processor shall at its own costs, take any steps
necessary as the Client or Intermediary may reasonably request to remedy such noncompliance.
15Liability

15.1

Any breach of this Addendum shall be treated as a breach of the Principal Agreement andthe liability for such breach shall be treated in accordance with the relevant provisions ofthe Principal Agreement.

16Continuity

16.1

The provisions of the Principal Agreement shall, save as amended by this Addendum,continue in full force and effect.

17Conflict

17.1

Where a conflict arises between any provision of this Addendum and any provision of thePrincipal Agreement, the provisions of this Addendum shall take precedence over theconflicting provisions of the Principal Agreement, and this Addendum shall be deemed toamend the Principal Agreement to the extent of such conflict.

18

Governing law and jurisdiction

18.1

This Addendum shall be governed by and construed in accordance with the same
governing law the parties have chosen to apply to the Principal Agreement. Any disputearising under or in connection with this Addendum shall be resolved in accordance with therelevant provisions of the Principal Agreement.

7BLAW-39578264-4

Annex
Personal Data Processing
Details in relation to the Processing of Personal Data
Subject Matter

The performance of the Services.

Duration

The Processing shall continue until the later of:(i) the Principal Agreement being terminated in accordance with its
terms; and(ii) the Client and/or the Intermediary and/or Ogier Global no longer
being subject to an applicable legal or regulatory requirement tocontinue to store the Personal Data.

Nature & Purpose ofthe Processing

Ogier Global Processor will process Personal Data in accordance withthis Addendum for the purposes of providing the Services under thePrincipal Agreement.

Categories of Data
Subjects(i) the Client and (where they are not natural persons) their owners,controllers, investors, directors and officers and personnel);(ii) where they are natural persons, their family members; and(iii) members, partners, agents, prospective investors, individuals thatare connected to the above-mentioned including those who may beparty to or connected to a party to, a legal transaction involving theClient and/or the Services.

Types of Personal
Data

Demographic
Data/Identifying Information

Name, title, gender, date of birth, age,nationality, photographic identification (e.g.
passport, driver's licence or national
identity card)

Contact Details

Home/work landline telephone number,personal/work mobile phone number,home/work postal address, personal/work
email address

Financial Data

Bank account number, source ofwealth/income and other personal assets

Professional
Information

Job title, employer details, employment
history, qualifications, memberships ofprofessional bodies

8BLAW-39578264-4

Controller's Rights
and Obligations

Government Identifiers

Passport number, social security number,driver's licence, income tax number

Family Information

Family structure, siblings, children

The Client's and/or Intermediary's rights and obligations in their capacity
as controller are described in this Addendum and the Principal
Agreement.

Addendum dated February 2020

9BLAW-39578264-4